Introducing SQRL ing🐿—a Technique for Secretly Bribing Attackers into Revealing They Have Your Seed

hey everybody um cool yeah so uh everybody my name is greg i'm the cto and co-founder at chainsafe uh if you're not familiar with us we're a blockchain r d studio that kind of focus on more low-level infrastructure things like building e2 clients and uh file coin clients and stuff like that um and yeah so uh today i'm giving a bit of a different talk i usually dive into more infrastructure stuff it's a little bit more complicated i figured since there's usually a lot of more newer people here in the space especially in denver i want to talk a little bit about wallets which is a bit of a passion of mine and to kind of talk about some lost or forgotten features of wallets that are accessible to everybody to give you a little bit better security during your everyday activities to ensure that maybe you won't lose as much funds just by being a user of the space so today my talk is called squirreling um it's a way to bribe attackers into revealing that they have your seed phrase um seed phrase is a mnemonic but i will no longer be using the word mnemonic we talk about seed phrase now um it's better experience um and basically uh you know as i said this is to like re-educate if you know about it that's awesome but i think a lot of people may not have remembered okay cool um sweet so what does sqrl stand for it stands for simultaneously qualified roots with lure what does that mean uh it basically is describing like the path of the hd node and how it's like generated from a mnemonic why is it smelled like that because a dear friend of mine who actually brought this introduced this concept to a couple back in 2018 richard moore fitted the name backwards because he liked the idea of that squirrels bury acorns uh but richard is the creator of ethers.js he's the one who actually came up with this concept a couple years ago and i figured it was good time to reintroduce it and make it a little bit more easily consumable um and digestible for the everyday user and so that's what i'm going to talk about today is squirreling um so before we jump in i just want to get a quick gauge of the audience um you know so if i could get everybody to raise their hand not right now but raising keep it raised because i'm going to have a series of questions you know so um raise your hands if you have a wallet all right you guys all failed the first test of opsec congrats keep it up keep it up keep it up keep it up we're not done we're not done um you know how many of you created your wallet this year keep your hand up if you created this year first wallet your wallet's the first one this year all right i guess everybody is a whale in the room congrats you also failed the second test uh any of you in here create wallets or all right do you show the user a mnemonic do you give the user their mnemonic okay well do you know about the password in the mnemonic adding a password the 25th word all right well i'm going to convince you otherwise today so hopefully maybe you change that because that's the most important feature i think a wallet can have for a user basically um let's just talk about while it's really quick right we've got the concepts of hot cold and hardware wallets you know we've got people talking about hey you know like why are people throwing hundred eth on their metamask account and then it gets compromised you know there's you know you should be putting this on a hardware wallet it's so much more secure or whatever really a hardware block doesn't help you because ultimately at the end of the day you know the biggest problem we have is that the weakest link in the entire chain no matter how good your wallet software is no matter how good you are at educating your users the weakest link is always going to be the user because the weakest link starts at the at the secret phrase it starts at those 24 words those 12 words that you give your users and you show to them and now you're hoping they know how to secure them you know i'm not going to get into best practices of securing your words some people put it in their sock drawer some people put them in distribute them across multiple different like safety deposit boxes some people scramble them it doesn't really matter how you do it at the end of the day that's the weakest link and that's what we need to protect and educate our users on how to better protect it by using some features that are a little bit more perhaps forgotten um and so you know how do we store it and like how do we do it oh sorry i should have skipped this side whoops that was the next one i got ahead of myself but anyway it's like as i said you know the user's gonna store however they want to store it you're as a developer as a app wallet you know user you gotta be really careful um and so you know show of hands here like how many people know about like the 13th word or i've heard of like that 25th word uh in the mnemonic set or in the secret phrase no nobody holy cow yeah see this is why i'm giving this talk everyone seems to forget about this stuff so there's there's like this extra word that you can put in in the code when we're generating from the seed phrase we call it a password and um in more cases than enough and you might know this as a wallet developer um you know we we actually set the password to an empty string nine times out of ten um and that's fine but really what it does is if we put a password in there you're basically adding like an extra step of you know to this an extra step an extra word in the mnemonic set that basically makes it that much harder to guess what what the actual thing is um and you know during the process you can see it gets salted and we chain it together that's all that's really happening it's just adding it one more time um so it's a 25th word you can make it 14 uh 13. and in reality your mnemonic or your sorry your secret phrase can actually be like 100 words if we really want it to be i'm just 24 is a nice number 12 is easy and computational wise it just makes everybody's lives a little bit easier but let's talk about how we can use this password to actually [Music] make it a safer environment for yourself your users and as well as just your funds that you've got stored on there um so let's kind of talk about how this works i'm going to use a term that we're going to call the canary that's your default account so in the previous step right and if the password is set to an empty string right that would be your default account that's to be honest what 90 percent of you are probably using today you know you go on meta mask you create it that's your default account the password is set to empty string so you have like perhaps um zero x one zero x two zero x three so and so forth are created you know these addresses these are yours we're gonna call these the canaries moving forward now if we add the password which can be anything it could be a hundred characters of random strings generated from your your password manager or it could just be your name it really doesn't matter um probably use something more secure than your name um but what you'll get is you get your squirreled accounts and these ones are going to be completely different and this is because um you know that root node that's generated when you go to actually turn your secret phrase into a wallet is different like on the curve it just sits completely different but this is deterministic we'll always get the exact same squirrel accounts as long as you're using the same first 24 12 words from your default or your canary accounts so because we can deterministically generate these every single time we actually land ourselves in a very unique position here where you can write these down you can write your 24 words down your 12 words store them away and then just keep the other one in your head or store it somewhere completely separate somewhere nowhere where it's just a word written down on a piece of paper no one will ever really understand what it's about and now what we can do is we can use the canary to be you know what miners use a canary for us to make sure in case things were toxic in the mines you know the bird would die but we can do the same thing with the canary accounts let's say you put one eath in the canary account you then put a hundred each in your squirreled accounts if someone were to find your mnemonic and drain or sweep your funds they would only be able to sweep the default canary accounts because the chances of them brute forcing that extra word or even wanting to think that they could brute force to find more funds is like mathematically really high and i don't want to think about the math there but it's really really tough i mean like try brute forcing 24 words today to you know get anybody's wallet it's really difficult um and this is just adding that one step and that's the benefit of allowing your users or allowing yourself as a user to actually just do this add that extra word you get that level of guarantee that level of safety that your actual funds won't be compromised maybe as quickly and what you know how do we let's put this into practice and i'll give you guys some a really good example of like how we can use this to defend yourself um which is with this infograph here so let's imagine somebody steals your recovery phrase your secret your secret phrase they're going to go and sweep that account right away guarantee you the bots are they got bots going and that will happen right away instantaneously but if you use an email notification service of text notifications or epns i really don't really care what it is some service that will give you a notification that your funds have you've made a transfer then what you can do it's pretty simple you'll just get a phone call an email that'll say hey your canary account just got drained and you don't have to panic you don't actually have to pay there's no like you know if you didn't do this setup and you had all your 100 eth on the default accounts or the canaries you'd be panicking because you're done there's no rollbacks we're not rolling back the chain just for your your account but you don't have to worry now because again our is like can you brute force that extra word would they be able to probably not so you can spend the next 24 hours to slowly figure out okay what's my key rotation strategy going to be how am i going to get a new a new mnemonic what am i going to do figure out why you got compromised how you got compromised and then you can rotate all your keys hell you could probably leave the canary the the the squirreled accounts in there probably for a longer time because i guarantee you they'll discard that mnemonic and not look at it again but it gives you time it gives you time to re-secure your accounts to ensure that you actually don't lose and take a big hit and that's the bribe put up a little bit of insurance policy in those canary accounts to incentivize somebody that actually gets your secret phrase to drain it you know what does it cost here if you had 100 eath how much eat would you be willing to lose to ensure you don't lose the hundred 10 10 insurance policy that's a big insurance policy and it's worth it and it's really simple to do this is a really simple technique and i really hope wallet users end up uh nice huh what do we have here uh cool um cool uh and yeah that's it it's really simple it's a really simple thing to do that will greatly improve the quality of how you do things um let's talk about just like how and where you can use this uh most wallets don't support this whatsoever metamask coinbase wallet not that i'd suggest it but like you know any of these wallets they do not support this passphrase um why because i think it was considered an advanced feature back in the day and i think you know we need to stop thinking that like pro advanced features are scary and we need to start educating because it's a really simple thing to add ether's web3.js which we develop we all support it as a developer if you're using any of our libraries you can simply just jump on in add that passphrase give your users that level of assurance or yourself ledger treasurer lattice they all support it the settings buried it's not like the easiest thing to do after this if you want to like see how it's done in ledger if you go to the chainsafe blog you can find my article called swirling and it does i've got photos explaining exactly how to do it on a ledger it's about i did it once and it took like 15 minutes to set up and it's pretty nice it's really easy there's two pins you know you just your one pin gets you into your canary your secondary pin gets you into your actual stuff and it's really the your ux does not get hindered um as a wallet developer you know i think it's just not that hard to expose it's just an extra form field now obviously you got to be careful about how you're securing it in like the state storage but really consider adding it because i think this is something that will help a lot of people not get drained especially when they're you know accidentally paste your mnemonic in some nft airdrop because they got you but they won't get all your stuff right and that's what matters so that's my short and quick talk if anybody has questions i'm happy to take some questions otherwise i got some ending stuff yes hold up let me give you the mic i have a seed phrase and i have a password now you're setting up a second account with just the seed phrase with no password to create a canary account because the first one squirreled no no sorry yeah maybe that wasn't well defined um in this graph info we're using the exact same seed phrase and we're literally appending we're just adding that extra word onto that the seed phrase so use one seed phrase two completely separate accounts set of them in half and how do you create them to be different from each other um by adding a password are you familiar with how wallet derivation works um okay uh think of a tree cool we have a a node you know when when you you take that seed phrase and it turns into this what we call like a root node and it sits right here it's like this little circle let's pretend it's got all this data about how we're going to create your account so you guys have you know you've seen the m forward slash six four slash zero zero one you know and that's like the derivation path you might see like ledger live or you know old ledger and and that's the path so it's going to tell this hd node when you put that in there how to find it right um and then by adding another word you can imagine if this is like a curve right where the where the where the the actual private key curve kind of sits the idiot's a curve you know it might be here with the 24 words but if you have that 25th it's going to shift just slightly down here which means that path is going to completely change and you'll get a whole new brand new set of accounts now am i doing this at the code level or is this something that is done when i create a password what do you mean by creating a password meta mask like metamask has my password that lets me activate it from a wherever what wherever i put the seed phrase in yeah yeah okay good good point um probably should have addressed that earlier that password that metamask has is basically locking the ui it doesn't do much more it might be encrypting the seed phrase in the browser but it's literally that's all it's doing it's just locking that 24 words or 12 words i guess mass uses and nothing more this is basically saying you're taking 12 words plus one more and that's how you're doing it um and how do i do that well you have to use it on a ledger or a trezor or a lattice because most wallets refuse to add this and i'm hoping we can all tell them to change that thank you no problem so quick question uh so why not just use let's say like how they have the whole like 12 and uh 24 like mnemonic generation right why not just have 11 of it dynamically generated from the ui and then just have that 12th one or better yet like that 24th one be something that's like manual input like what's i mean i could be thinking about this wrong but that you're saying exactly how i'm saying it okay gotcha yeah instead of just 25 or 13. why not i think there's a restriction i think you have to actually use like 12 24 i think there's like actual lengths i could be wrong there but i think that i do believe there's lengths that have to be met that's the other thing yeah i mean that's just like really hard they're not just like like more long lines of it dynamically being all 24 characters you instead just have the end user just uh like have like create their own like uh yeah you're basically saying hey wallets won't adopt this so i'm just going to remove the the 24th word and only input the 23.

you can't they're they do hard checks like 12 of 24. i wasn't sure i was just asking that yeah i know good question though they do hard checks yes last question hi greg um so on the slide where it showed like the attacker stealing the funds presumably the person holding the account is taking some steps to like even the canary account like keep it really safe um but then somehow an attacker gets a hold of it and so i just don't quite understand like what's the mechanism that prevents the attacker from getting a hold of the squirrel account don't write the password on the same sheet as the secret phrase so in this case we're assuming that the way that the attacker got our seed phrase is by somehow physically getting their hands on that or you copy pasted it somewhere maybe you threw it up on you know google drive like some folks we know about from two weeks ago that lost a lot of money but presumably a user could do that with the squirrel account as well right yeah again this it's user safety right we have to we have to educate how to do this one ultimately like you could use some really simple words a password that like you just used on a day to day somewhere and like chances are someone won't brew force that like mathematically maybe get to your key rotation faster but like the brute force on the cryptography side is just tough so kind of like the key to this here you may be able to be like kind of play fast and loose with the canary accounts but that password treat like fort knox or what that's kind of the whole gist of it absolutely yeah gotcha cool and thank you i know that was the last question and just before i head out i do want to point out chain safe is hiring we work across an amazing stack of javascript rust and go amongst other things and we do work on an incredible amount of projects web 3.js i'm sure if you develop you know it lodestar gossamer and polkadot forest and falcon mina and we have a gaming sdk in unity that you should try out we'll be at castle all weekend if you need any questions find somebody in the lovely yellow hoodie thank you all [Applause]